German Privacy Watchdog Orders Data Deletion

A key German privacy watchdog has ordered Sam Altman’s World project to delete biometric data it collected by scanning people’s eyeballs to verify they are human.

The Bavarian State Office for Data Protection Supervision, or BayLDA, stated that the company must provide a deletion procedure that complies with GDPR within one month of the decision’s enactment. World will also need explicit consent for certain processing steps in the future. The office’s action follows an investigation that began in April 2023.

World, a crypto-based human verification initiative previously known as Worldcoin, has appealed the decision. The project has faced ongoing scrutiny from regulators aimed at limiting its collection and storage of biometric data. Backed by Altman, who is also OpenAI’s CEO, World argues it has taken steps to address these concerns, including shifting to a system where biometric data is no longer stored.

BayLDA’s inquiry, according to World, pertains largely to outdated operations and technologies that were replaced in 2024. To comply with GDPR, World now no longer stores iris codes used for verification, and it has deleted previously collected codes to ensure no personal data is retained.

World has received mixed reactions across Europe. It launched in Austria in July, but Spain extended its ban until a GDPR audit is complete. Portugal ordered a temporary halt to biometric data collection in March. However, World recently began operations in Brazil, aiming to provide digital identification to a broad audience.

World believes that as AI continues to proliferate, a reliable system distinguishing humans from automated agents is necessary. The project uses small silver orbs for eye scanning and rewards individuals with cryptocurrency (WLD tokens) upon obtaining their World ID.

In response to regulatory scrutiny, World introduced “Personal Custody” in March, allowing individuals signing up for World ID to opt-out of biometric data storage and encryption.

World emphasized the need for a clear and consistent definition of anonymization within the EU to protect personal data in the AI era.